Threats tagged 'ghsa-9fp3-498j-448j'

The Call for Price plugin for WooCommerce on WordPress is vulnerable to stored cross-site scripting (XSS) in all versions up to and including 4.2.0. This vulnerability arises from insufficient input sanitization and output escaping in admin settings. It affects only multi-site installations or those where unfiltered_html is disabled. Authenticated users with administrator-level permissions can inject malicious scripts that execute when other users access the affected pages.